CVE-2018-16889

ceph: debug logging for v4 auth does not sanitize encryption keys

Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ceph Ceph Storage

CVE-2018-16888

systemd: kills privileged process if unprivileged PIDFile was tampered

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Netapp Redhat and 1 more

Products

Ubuntu Linux Active Iq Performance Analytics Services Element Software and 3 more

CVE-2018-16887

katello: stored XSS in subscriptions and repositories pages

A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Satellite Capsule Katello

CVE-2018-16886

etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed

Vendors

Etcd Fedoraproject Redhat

Products

Etcd Fedora Enterprise Linux Desktop and 3 more

CVE-2018-16885

kernel: out-of-bound read in memcpy_fromiovecend()

A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar functions with a zero offset and buffer length which causes the read beyond the buffer boundaries, in certain cases causing a memory access fault and a system halt by accessing invalid memory address. This issue only affects kernel version 3.10.x as shipped with Red Hat Enterprise Linux 7.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux Server and 1 more

CVE-2018-16884

kernel: nfs: use-after-free in svc_process_common()

A flaw was found in the Linux kernel's NFS41+ subsystem. NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

CVSS 3.1 · 8.0 High EPSS 1.5% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 5 more

CVE-2018-16881

rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled

A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Debian Redhat Rsyslog

Products

Debian Linux Enterprise Linux Enterprise Linux Desktop and 11 more

CVE-2018-16879

Tower: security channel is not set properly for AMPQ connection

Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configuration channel settings for messaging celery workers from RabbitMQ. This could lead in data leak of sensitive information such as passwords as well as denial of service attacks by deleting projects or inventory files.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2018-16878

pacemaker: Insufficient verification inflicted preference of uncontrolled processes can lead to DoS

A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Clusterlabs Debian and 3 more

Products

Ubuntu Linux Pacemaker Debian Linux and 6 more

CVE-2018-16877

pacemaker: Insufficient local IPC client-server authentication on the client's side can lead to local privesc

A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this flaw, and combine it with other IPC weaknesses, to achieve local privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Clusterlabs Debian and 3 more

Products

Ubuntu Linux Pacemaker Debian Linux and 6 more

CVE-2018-16876

ansible: Information disclosure in vvv+ mode with no_log on

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed

Vendors

Canonical Debian Redhat and 1 more

Products

Ubuntu Linux Debian Linux Ansible and 7 more

CVE-2018-16871

kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence

A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS filesystem, is able to trigger a null pointer dereference by using an invalid NFS sequence. This can panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will be lost.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Linux Netapp Redhat

Products

Linux Kernel Cloud Backup H300e and 28 more

CVE-2018-16863

ghostscript: incomplete fix for CVE-2018-16509

It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.

CVSS 3.0 · 7.3 High EPSS 1.2% KEV · Not listed

Vendors

Artifex Redhat

Products

Ghostscript Enterprise Linux Enterprise Linux Desktop and 5 more

CVE-2018-16862

kernel: cleancache: Infoleak of deleted files after reuse of old inodes

A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Linux and 1 more

Products

Ubuntu Linux Debian Linux Linux Kernel and 1 more

CVE-2018-16861

foreman: stored XSS in success notification after entity creation

A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Hosts, Monitor, Infrastructure, or Administer Menus is able to execute a XSS attacks against other users, possibly leading to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Foreman before 1.18.3, 1.19.1, and 1.20.0 are vulnerable.

CVSS 3.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Redhat Theforeman

Products

Satellite Satellite Capsule Foreman

CVE-2018-16859

ansible: become password logged in plaintext when used with PowerShell on Windows

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.

CVSS 3.0 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Engine

CVE-2018-16858

libreoffice: Arbitrary python functions in arbitrary modules on the filesystem can be executed without warning

It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.

CVSS 3.0 · 7.8 High EPSS 67.3% KEV · Not listed

Vendors

Libreoffice Redhat

Products

Libreoffice Enterprise Linux

CVE-2018-16856

openstack-octavia: Private keys written to world-readable log files

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Openstack Redhat

Products

Octavia Openstack

CVE-2018-16850

postgresql: SQL injection in pg_upgrade and pg_dump, via CREATE TRIGGER ... REFERENCING

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges.

CVSS 3.1 · 9.8 Critical EPSS 5.1% KEV · Not listed

Vendors

Canonical Postgresql Redhat

Products

Ubuntu Linux Postgresql Enterprise Linux and 1 more

CVE-2018-16849

openstack-mistral: std.ssh action may disclose presence of arbitrary files

A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem.

CVSS 3.0 · 3.1 Low EPSS 1.5% KEV · Not listed

Vendors

Redhat

Products

Openstack Openstack-mistral